What we promise, what we don't.

These Terms form a contract between you (the customer) and KiwiStack, a sole proprietorship operated by Corentin Dekimpe from Luxembourg, VAT-registered in Luxembourg. Postal address available on request. Contact: hello@kiwistack.io.

By starting a paid subscription, you agree to these Terms, to the Data Processing Addendum, and to the Privacy Policy below. If you do not agree, do not use the service.

A managed open-source office suite delivered as one of three tiers (Core, Mesh, Fleet) plus the optional Intelligence add-on. Published pricing, full feature list, and tier comparison live on /pricing. Architecture and operational details live on /architecture. Both pages are part of these Terms by reference.

We may improve or change underlying open-source components, vendors, and infrastructure choices, provided we do not materially reduce the capabilities you bought. Material reductions are notified at least 30 days in advance; you can terminate the affected service with a pro-rata refund if you object in writing.

Prices are published on /pricing, in euros, excluding VAT. Volume discounts (−5% from 25 users, −10% from 50 users) apply automatically. Invoices are issued monthly or annually depending on the billing cadence you elect at signup. Payment is due within 14 days of invoice. Late payments may accrue interest at the statutory Luxembourg rate.

VAT is added per Luxembourg rules: reverse-charged for B2B customers established in another EU Member State who provide a valid VAT identification number; charged at the standard Luxembourg rate otherwise.

Setup fees, when applicable, are detailed on /pricing and waived with a 12-month initial commit.

The initial term is what you elect at signup: typically monthly or twelve months (annual prepay). After the initial term, the contract auto-renews on a monthly basis until either party gives 30 days' written notice before the next renewal date. Notice by email to hello@kiwistack.io is sufficient.

For the first five founding-cohort customers, the offer is: three months free, no commitment, no card on file, no setup fee. After the free period the standard terms above apply.

You may terminate at any time with the notice above. On termination, you receive a full data export (mailboxes as EML and maildir, files in original formats, calendars as iCal, contacts as vCard, database rows in standard SQL) within the 60-day window described in the DPA. No proprietary lock-in by design.

Refunds. Fees already paid are non-refundable, except in one case: if we cause the termination (uncured material breach by us, or force majeure preventing the service for more than 30 consecutive days), we refund any unused prepaid fees on a pro-rata basis.

Termination for cause by us. We may suspend or terminate the service if you are in material breach (including non-payment for more than 30 days after a written reminder, or breach of T7 below) and have not cured the breach within 14 days of written notice. We may also terminate without cause with 90 days' written notice, in which case unused prepaid fees are refunded pro-rata.

We publish response times, not resolution times. The targets by tier are: 1 business day (Core), 4 business hours (Mesh), 1 business hour (Fleet). Business hours are 09:00 to 18:00 Europe/Luxembourg, Monday to Friday, public holidays excluded.

Status and incident history live at status.kiwistack.io ↗. Sustained breach of the response target across a calendar quarter entitles you to one month of fees as service credit, applied to the next invoice. Service credits are the sole financial remedy for SLA breaches.

You must not, and must not let your users: use the service to send unsolicited bulk email (spam), store or distribute content that is illegal in Luxembourg or in the country of the data subject, run security testing against the platform without prior written agreement, attempt to circumvent technical access controls, or resell the service to third parties without our written consent.

We do not screen the content you store. We may act on a documented legal order, a credible abuse report, or evidence of activity that endangers other tenants. Where we act, we tell you, unless a legal order prevents it.

We warrant that we will provide the service with reasonable care and skill, in line with the response times above, and that the published feature set will not be materially reduced during the initial term.

Beyond that, the service is provided "as is". We do not warrant that it will be uninterrupted, error-free, or fit for any specific purpose beyond what is described on /pricing and /architecture. Open-source components retain their respective upstream licences; defects in upstream code are addressed via our normal upgrade and patching cycle.

To the maximum extent permitted by law, our total aggregate liability arising from or related to these Terms is capped at twelve (12) months of fees paid in the twelve months preceding the event giving rise to the claim. Neither party is liable for indirect, consequential, special, or incidental damages, including loss of profits or business opportunities.

The cap and exclusion do not apply to: gross negligence, wilful misconduct, breach of confidentiality, breach of the data-protection obligations in the DPA insofar as Article 82 GDPR liability is concerned, or any liability that cannot lawfully be excluded under Luxembourg law.

We indemnify you against third-party claims that the platform itself (the way we have assembled and deliver the service) infringes the intellectual property rights of a third party in the EU, provided you notify us promptly and let us conduct the defence.

You indemnify us against third-party claims arising from your content, your team's use of the service in breach of T7, or your breach of representations you have made about your data (for example, that you have the right to upload it).

Each party treats the other's non-public information as confidential, with the same care it gives its own confidential information, for at least three years after disclosure. Customer content remains yours; we obtain only the rights necessary to provide the service.

We retain rights in the platform, our scripts, our templates, and the way we have assembled the open-source stack. Open-source components remain governed by their respective upstream licences, listed in /architecture.

Neither party is liable for delay or failure to perform caused by events beyond reasonable control (force majeure, large-scale internet outages, war, civil unrest, public authority orders, pandemic). If the event persists for more than 30 consecutive days, either party may terminate the affected service with a pro-rata refund of unused prepaid fees.

We may update these Terms. Material changes are notified at least 30 days in advance by email to your admin contact and on this page. If you do not agree, you may terminate within the notice period with a pro-rata refund of unused prepaid fees. Continued use after the effective date constitutes acceptance.

These Terms are governed by Luxembourg law, without regard to its conflict-of-laws rules. Exclusive jurisdiction lies with the courts of Luxembourg. The UN Convention on Contracts for the International Sale of Goods does not apply.

If a clause is held unenforceable, the rest stays in force. Failure to enforce a clause is not a waiver. Neither party may assign these Terms without the other's written consent, except in connection with a merger, acquisition, or sale of all or substantially all assets. Notices: in writing, to the addresses on this page and on your most recent invoice.

KiwiStack, a sole proprietorship operated by Corentin Dekimpe from Luxembourg, VAT-registered in Luxembourg, is the data controller for the data described here. Contact: hello@kiwistack.io. Postal address available on request.

At the scale at which KiwiStack operates, a formal DPO under GDPR Article 37 is not required. Corentin Dekimpe is the named contact for all data-protection matters.

None on this website. No cookie banner, because there is no cookie. No analytics, no heatmaps, no pixels. If this changes (for example, a privacy-respecting EU-hosted analytics tool like Plausible), we update this page and add a clear notice before turning it on.

For visitor and prospect data, the only third parties involved are the hosting and email providers needed to run kiwistack.io and to receive your email. For customer tenant data, the full sub-processor list (with role, location, and what they can access) lives on the DPA.

None. Hosting, sub-processors, and operator are all in the European Union (Germany, France, Luxembourg). We do not transfer your data outside the EU and do not use the EU-US Data Privacy Framework or Standard Contractual Clauses.

You have the right to:

• Access (Article 15): ask for a copy of the personal data we hold about you.
• Rectification (Article 16): correct anything that is inaccurate or incomplete.
• Erasure (Article 17): ask us to delete your personal data, unless we are required to keep it (for example, invoicing records under Luxembourg tax law).
• Restriction (Article 18): ask us to limit how we use your data while a dispute is resolved.
• Portability (Article 20): ask for your data in a structured, machine-readable format you can take elsewhere.
• Objection (Article 21): object to processing based on legitimate interest.
• Withdraw consent (Article 7): wherever processing is based on consent, withdraw it at any time. Past lawful processing is not affected.
• Not be subject to fully automated decisions (Article 22): we make no fully automated decisions producing legal effects on you.

To exercise any right, email hello@kiwistack.io. We respond within one month (Article 12(3) GDPR), in writing, free of charge.

If you believe we have mishandled your data, write to us first: we will respond. You also have the right to lodge a complaint with your local data protection authority. For matters under Luxembourg jurisdiction, that is the Commission nationale pour la protection des données (CNPD) ↗.

TLS on every endpoint, encrypted at rest, audit logs on privileged actions. The full baseline lives on /security and the operator-side technical and organisational measures are in Annex II of the DPA.

Material changes are announced on this page at least 30 days in advance and emailed to the admin contact for active customers. Editorial fixes (typos, clarifications) are made silently with the version number bumped.